Splunk monitor mode query

[Mansi24]

i have indexed data from a directory in monitor mode ,and while checking the status of files being indexed i found an error " ignored file (crc conflict, needs crcSalt)" in the filestatus.
what does this error signifies and how to rectify it?

[somesoni2 · Accepted solution]

For every file, splunk creates a CRC (cyclic redundancy check) handler, which is based on first few line of the file. This helps prevent re-indexing of same file (even though its renamed, especially in case of files which are getting rolled over). It seems that the files being ignored by Splunk, in your case ,have similar first few lines (characters) causing Splunk to ignore them.

To make Splunk read all the files in a directory regardless of similar files, you need to add "crcSalt = " in your input.conf stanza for the directory being monitored.

[monitor://C:\MyDirectory\*.log]
disabled = false
followTail = 0
sourcetype = myindex
crcSalt = <SOURCE>

Beware that, with this setting Splunk will index all the files, even though they have been renamed, rolled over.

[somesoni2]

It has to be written as it is (string literal). And don't forget to either restart splunk instance or refresh configuration using "http://splunk-server:port/en-US/debug/refresh"

[Mansi24]

thanks somesoni2,

just to confirm that the written should be as it is or so we have to give the actual source from where the data is accessed for ex. if data source is my own system than i have to give my as .